users without view permission on records can see records in kaleo process.

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.1.X, Master
• Fix Version/s: 7.1.1 CE GA2, 7.1.10 DXP FP4, 7.1.10.1 SP1, 7.1.X, Master
• Component/s: Business Productivity > Kaleo Workflow Forms
• Labels:
  • ee-ts
  • liferay-dxp-71-sp1
  • liferay-fixpack-dxp-4-7110
• Branch Version/s:
  7.1.x
• Backported to Branch:
  Committed
• Story Points: 0.25
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal-ee/pull/22209

Steps to Reproduce:
1. Start up Master-Private
2. In the Product Menu, go to Content > Kaleo Forms Admin
3. Add a new Process "Process A"
4. Click '+' to Submit New Process A
5. Assign to yourself and Approve the submission
6. Go to Users > Roles and add a new role with the following permissions:

Kaleo Forms Admin: Access in Site Administration
Kaleo Forms Admin > Process: Submit
Site Settings > Site: View Site Administration Menu

7. Go back to Content > Kaleo Forms Admin
8. Add the view permission to new role for Process A
9. Create a new user and assign the role created
10. Sign out and sign in as new user
11. Go to Content > Kaleo Forms Admin
Expected Behavior: New user cannot see Process submission for 1st user
Actual Behavior: New user can see Process submission for 1st user

In addition, the user created can click "view" or "delete" from the three-dot menu. This will lead to a PrincipalException being thrown.

Testing:
Reproduced in 7.1.x-private: 038b9236c98f4dd9f0839279d68991b208e1c65f
Reproduced in Master-private: ec26d582b6890e933eee88cb574c1be185cb9782
Could not see Kaleo Forms Admin in Product Menu